CORS Header & S3 Policy Generator
WHATWG Fetch SpecGenerate strict Cross-Origin Resource Sharing configurations for Nginx, Next.js, Express, Apache, and AWS S3 buckets.
1. Origin Policy & Credentials
Emits Access-Control-Allow-Credentials: true
2. Allowed HTTP Methods, Headers & Preflight Cache
# Nginx Server / Location Block CORS Configuration
location /api/ {
add_header 'Access-Control-Allow-Origin' 'https://app.example.com' always;
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization, X-Requested-With' always;
add_header 'Access-Control-Expose-Headers' 'X-Request-Id, X-RateLimit-Remaining' always;
add_header 'Access-Control-Allow-Credentials' 'true' always;
add_header 'Vary' 'Origin' always;
# Handle Preflight OPTIONS Immediately
if ($request_method = 'OPTIONS') {
add_header 'Access-Control-Allow-Origin' 'https://app.example.com' always;
add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization, X-Requested-With' always;
add_header 'Access-Control-Max-Age' 86400;
add_header 'Content-Type' 'text/plain; charset=utf-8';
add_header 'Content-Length' 0;
return 204;
}
}Always return HTTP 204 No Content with Content-Length: 0 on preflight OPTIONS requests to minimize edge bandwidth.
Cross-Origin Resource Sharing (CORS) Architecture & Preflight Mechanics
Cross-Origin Resource Sharing (CORS), defined in the WHATWG Fetch Living Standard, is an HTTP-header mechanism that allows a server to declare which external origins (scheme, hostname, and port) are permitted to read responses in a browser. Without explicit Access-Control-Allow-Origin headers, the browser's Same-Origin Policy (SOP) blocks client-side JavaScript from reading cross-origin API payloads.
Why Wildcard (*) Fails with Credentials
When a browser request includes cookies, HTTP Authentication, or TLS client certificates (credentials: 'include'), the Fetch specification strictly forbids returning Access-Control-Allow-Origin: * alongside Access-Control-Allow-Credentials: true. You must echo the exact origin and include Vary: Origin so CDN caches do not serve poisoned headers across tenants.
Optimizing Preflight Latency with Max-Age
Any cross-origin request sending Content-Type: application/json or an Authorization header triggers a preflight OPTIONS round-trip before the actual request. Setting Access-Control-Max-Age: 86400 instructs browsers to cache the preflight response in their internal CORS preflight cache (up to 2 hours in Chromium, 24 hours in Firefox).